Loading story…
The U.S. Federal Trade Commission unanimously rescinded its 2021 policy statement that asserted the FTC Health Breach Notification Rule applied to health and fitness apps, trackers, and other connected devices handling individually identifiable consumer health data. The statement had aimed to close notification and privacy gaps for products outside HIPAA’s traditional healthcare-organization scope, and contemplated enforcement actions and civil penalties for failures to report breaches or unauthorized disclosures.
The FTC said its 2024 amendments to the Health Breach Notification Rule now expressly cover health applications and connected devices, rendering the earlier guidance obsolete and of minimal additional benefit. The withdrawal also aligns with the White House deregulatory directive to eliminate unnecessary subregulatory guidance; organizations should continue to assess obligations under the updated rule rather than treating the rescission as removal of health-data breach-notification requirements.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
The FTC updated the Health Breach Notification Rule to cover health applications and connected devices, including fitness trackers. The agency later said this update made the 2021 policy statement unnecessary.
The FTC adopted a policy statement asserting that its Health Breach Notification Rule applied to health and fitness applications, trackers, and other connected devices collecting identifiable health information. The statement was adopted by a divided 3-2 vote during the Biden administration.
The FTC unanimously rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. It said the statement provided minimal benefit, had been superseded by rulemaking, and was obsolete under the updated notification rule.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **U.S. Federal Trade Commission (FTC)** issued a policy statement clarifying it will **not pursue COPPA enforcement** against websites and online services that collect, use, or share personal data *solely* to perform **age verification**, addressing industry concerns that age-checking could itself trigger COPPA liability. The FTC said the exemption applies only when providers give clear notice to parents/children, limit use of the data to confirming age, avoid retaining the information after verification, and share it only with third parties they are confident will maintain confidentiality; the agency also emphasized the need to **employ reasonable security safeguards** and take reasonable steps to ensure age-verification methods and vendors provide **reasonably accurate** results. The FTC said it plans to **review the COPPA Rule** to further address age verification, following earlier agency remarks framing age verification as an important child-protection tool. Separately, **Discord** announced it is **postponing and modifying** a planned global age-verification policy after user backlash, delaying rollout to the second half of 2026 and adding options beyond government ID or video selfies (e.g., credit card verification), along with commitments to vendor transparency and a forthcoming technical explanation of its “age determination systems”; this reflects broader regulatory pressure for platforms to verify user ages but is distinct from the FTC’s COPPA enforcement posture.
Jun 29, 2026
The U.S. Federal Trade Commission, joined by California and Utah, sued telehealth provider **Hims & Hers** over allegations that it disclosed sensitive patient and health-related information to advertising and technology platforms including **Meta** and **Snap** while representing that it protected user privacy. Regulators say the company used tracking pixels and similar tools from multiple third parties, including Microsoft, Pinterest, Reddit, and X, to collect and transmit users’ website activity and health-related data without adequate disclosure or consent. The complaint also alleges broader consumer protection violations, including charging some users before medical consultations and making subscription cancellations unnecessarily difficult, leading to recurring charges. Hims & Hers said its privacy policy explains users’ choices regarding data use and that it plans to contest the allegations, while the case adds to growing enforcement pressure on telehealth and healthcare firms over the use of advertising trackers on services handling sensitive medical information.
Jul 31, 2026
European privacy regulators issued roughly **€1.2B in GDPR fines in 2025** and received an average of **443 personal data breach notifications per day** (a reported 22% increase year over year), according to DLA Piper’s GDPR Fines and Data Breach Survey as cited by DataBreaches.net. The reporting indicates sustained enforcement since GDPR’s introduction, with cumulative penalties reaching **€7.1B** since 2018, alongside a continued high volume of breach notifications to data protection authorities. In the U.S. healthcare sector, HIPAA Journal reported that **November 2025** showed unusually low counts of large breaches listed on the HHS OCR breach portal (**32 incidents affecting 500+ individuals**), but attributed the apparent decline to reporting delays during the **U.S. government shutdown (Oct 1–Nov 12, 2025)** and a resulting backlog. Separately, Central Maine Healthcare disclosed a breach affecting **~145,000 individuals**, with unauthorized network access occurring between **Mar 19 and Jun 1, 2025** and exposure of data including **names and Social Security numbers** plus clinical/insurance details; notifications began in late December 2025 and credit monitoring was offered.
Jun 29, 2026